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TO ^ EGRET//C OMINT//NOFORN/ — 391123 

NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G. MEADE, MARYLAND 20755-6000 


28 February 2006 


MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD 

THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT: (U//FOUO) Report to the Intelligence Oversight Board on NS A 
Activities - INFORMATION MEMORANDUM 


(U//FOUO) - Except as previously reported to you or the President, or 
otherwise stated in the enclosure, we have no reason to believe that any intelligence 
activities of the National Security Agency during the quarter ending 31 December 
2005 were unlawful or contrary to Executive Order or Presidential Directive, and 
thus required to be reported pursuant to Section 1.7.(d) of Executive Order 12333. 


(U/7F(JU0>-The Inspector General and the General Counsel continue to 
exercise oversight of Agency activities by means of inspections, surveys, training, 
review of directives and guidelines, and advice and counsel. These activities and 
other data requested by the Board or members of the staff of the Assistant to the 
Secretary of Defense (Intelligent Oversight)>«are described in the enclosure. 




EL F. BRENNER 
neral 



)EITZ 
feral Counsel 


(U/ /FOUO) I concur in the report of the Inspector General and the General 
Counsel and hereby make it our combined report. 



KEITH'B. ALEXANDER 
Lieutenant General, U. S. Army 
Director, NSA/Chief, CSS 


Enel: 

Quarterly Report 
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1. (U) INSPECTOR GENERAL ACTIVITIES 

a. -4C//DffDuring this quarter, the Office of Inspector General (OIG) reviewed 
various intelligence activities of the National Security Agency/Central Security 
Service (NSA/CSS) to determine whether they were conducted in accordance with 
applicable statutes, Executive Orders (E.O.s), Attorney General (AG) procedures, 
and Department of Defense (DoD) and internal directives. With few exceptions, the 
issues presented were routine and indicated that the operating elements 
understand the restrictions on NSA/CSS activities. 


b. (U//FOUO) Resulting from issues raised in intelligence oversight reporting, 
the OIG has begun a special study of the access to Signals Intelligence (SIGINT) by 

The objectives of the special s tudy include 


determining whether|___[that receive 

SIGINT have the proper authorization to receive SIGINT, have been provided 
guidance on how to properly handle and use SIGINT, and have adhered to the 
authority of E.O. 12333 and related directives regarding awareness, protections, 
and reporting of U.S. person information. The study results will be reported upon 
completion. ,b)( 3 )-e.L. 86-36 

c. (U //FOUO) As r esearch has begun on the aforementioned special study, initial 

data collected on one_joints to possible E.O. 12333 infractions 

in areas unrelated to NSA/CSS. We are reviewing that data for referral to the 
appropriate agency. 


(b)(3)-P.L. 86-36 


d. (U/ /FOUO> First reported in the fourth quarter fiscal year 2005 (report dated 
14 December 2005), the NSA/CSS OIG re viewed an incident that occurred during 
an operations readiness a ssessment of the j I We found 

t hat the NS A | Violated National Security Directive! |by errone ously 


exercise to assess the vulnerability ofj 
jecause of an inconsistency in the tare 


computer networks. This error occurred because of an in consistency 
validation process. A gency management has revised the I 


target 


to reduce the risk of future violations. 


■ 


(b) (3)-P.L. 86-36 


e. (U//FOUO) Along with inspectors from the| 


| [the NS A 01 

G completed a joint inspection ol the| 


Our most serious intelligence oversight finding was that 

Derived From: NSA/CSSM 1-52 
Dated: 20041123 
Declassify On: 20291123 
r.rn rT//mMrNT//NOFOR wrmm i iTri 

—SOP £ 


1 O P S E CRET//COM1NT//NOFORN//203U1129 


DOCID: 4165194 


the site violated intelligence oversight procedures. | _ 

without submitting a test plan for review and 
approval by the NSA/CSS Ulhce ol General Counsel (OGC). Other weaknesses were 
found in training and program management. NSA/CSS OIG will monitor the 
deficiencies through correction. (b) (3)-p. l. 86-36 

f. (U//FOUO) As reported i n the third quarter fiscal year 2005 (report dated 17 
may 2005), inspectors from the | | 

I the NSA GlG conducted a joint 

inspection of the f 

Action has been completed to rectify the weakness in its training program, which 
has been amended to provide intelligence oversight training for personnel who did 
not have access to the Sensitive Compartmented Information Facility. 


2. (U) GENERAL COUNSEL ACTIVITIES 

f O//GI) T he NSA/CSS OGC reviewed various intelligence activities of the NSA/CSS 
to determine whether they were conducted in accordance with applicable statutes, 
EOs, AG procedures, and DoD and internal directives. The OGC advised Agency 
elements on a number of questions, including the collection and dissemination of 
communications of, or concerning U.S. persons; the reporting of possible violations 
of federal criminal law contained in SIGINT product; the testing of electronic 
equipment, and the applicability of the Foreign Intelligence Surveillance Act 
(FISA). With few exceptions, the issues presented were routine and indicated that 
the operating elements understand the restrictions on NSA/CSS activities. 


3. (U) SIGINT ACTIVITIES 


a. - (S//S fr-Collection Against U.S. Persons 
(1) (U) Intentional 


(b)(1) 

(b)(3J-P.L. 86-36 


a. ■■ (TS//BU During this quarter, the Director, NSA/Chief CSS 
(DIRNSA/CHCSS) granted approval for consensual collection againstf__|U.S. 
persons. DIRNSA/CHCSS also approved non-consensual collecti on ofl l u.S. 
companies openly owned and controlled by a fo reign governmen t, [ J.S 
Govern ment employees held captive by foreign |U.S. citizens taken 

hostage! 


]DIRNSA/CHCSS-approved consensual collection 


against U.S. persons was routinely terminated this quarter. 
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(b)(1) 

(b)(3J-P.L. 86-36 
(b) (3)-18 USC 798 
(b)(3)-50 USC 3024(i) 
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b. (S//SI) T he AG granted authority to collect the communications of U.S. 
persons overseas during this quarter. 

..... (b) (1) 

(2) (U) Unintentional (b) (3) p L 86 36 


a.-(S//SI//NP)-This quarter, there were| [instances in which analysts 
inadvertently collected communications to, from, or about U. S. persons while 
pursuing foreign intelligence tasking. All of the incidents were reported to 
responsible oversight officials, and corrective actions were taken. 


action by a | 

collection was of U.S. person! 


of the 
lanah 


S incidents was compounded by inappropriate 
Upon learning that the inadvertent 


le analyst to mime 


„_ 7 _I 

J Upon learning of the incident management instructed 
ily delete the intercept and was provided remedial training. 


12]4€WS_| an analyst submitted a raw traffic 

database query for an email addre ss but inadvertently left off part of the address. 
The omission caused a flood of overj [inwanted results. Realizing the mistake, 
the analyst immediately deleted the results without viewing them. 


(b)(1) 

(b) (3) -p.lPk (U//frOH©) Dissemination of U.S. Identities 
(1) (U) Intentional 

(a HS//Sl ] | d uring this quarter, a£ 

passed raw traffic containing threat information 


(b) (1) 

(b)(3)-P.L. 86-36 
(b 1.(3)-18 USC 798 
(b) (3)-50 USC 3024 (i) 


(b)(1) 

(b)(3)-P.L. 86-36 


wefe included to facilitate notification by the [ 


le names ol 


persons 


•(b) (1) 

fb)(3)-P.L. 86-36 


(b) (G//0U"In accordance with section 7 of United States Signals- 

Intelligence Directive (USSID) SP0018, U.S. identities were disseminated 
times during this quarter. The following table shows the justification and the 
number of instances of dissemination. In the “Unmasked by Analyst” column, the 
U.S. identity was revealed in a serialized end product; in the “Unmasked at User 
Request” column, a U.S. identity w as released to a user at the user’s req uest. One 

of the di sseminations occurred in a] ~| The _ 

Ishared the report with thq 


(b)(1) 

(b)(3J-P.L. 86-36 
(b)(3)-50 USC 3024(i) 
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(b)(1) 
(b)(3)-P. 
(b)<3)-50 


JUSTIFICATION 

Unmasked 
by Analyst 

Unmasked at 
User Request 

TOTAL 

7.2.c Necessary 



7.2.C.1 Foreign Official 


7.2.C.3 International Narcotics 


7.2.C.4 Criminal Activity 


7.2.C.7 U.S. Government Official 


TOTAL 



(2) (U) Unintentional 


"(b)(1) 

(b)(3)-P.L. 


86-36 


a.^S/ZSIfOuring this quarter, the Signals Intelligence Directorate (SID) 


cancelledSIGINT products because they contained the identities of U.S. persons, 


organizations, or entities. 


products were reissued after minimization. 


b.—( TS//GD 


{released | [ reports containing the 


identities of U.S. persons or base d on the co mmunications of persons later identified 
as U.S. persons. In all instances, 1 [ cancelled the reports, which were either 

not reissued or were reissued with the proper minimization. 


(T0//SI//NF) An incide nt involv ing the possible diss emination of U.S.[ 

ed to" 


occurre 


£ 


Jam 


was reported 
The data was 


the OIG by NSA’s | __ 

allegedly contained in a graphic chart that may have been shared during briefings 
in and outside of NSA. An OIG inquiry has been tasked to determine the facts of 
the incident, which will be reported upon completion. 


(b) (3)-P.L. 86-36 


(3) (U) Raw Traffic Dissemination — SIGINT Production Chair* b) cu 

(b) (3) - P. L. 86-36 

( S //3I) | \ \ " | 


The SID ensures that the personnel are trained by the OGG 

on JNSA/CSS' s legal restrictions and on proper handling and dissemination of _ 

SIGINT data 

4 
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\b)(31-P.L. 86-36 


SID during this quarter included representatives of the 


4. (U) Other Activities 


a. (U//FOBO) FISA Incidents 


(b)(1) 

(b)(3)-P.L. 86-36 


.tm (i) 

(b (3) -P. 1. 86-36 
(b)\'< 3) — 18 USC 798 
(b)\(;3)-50 USC 3024 (i) 


(l)tT0//SI// NF) Human error al lowed collection to conti nue four days past the 
expiration of a FISA authorization ! ~\ Prior to the expiration, 

an NSA analyst requested that the ] Ibe nlaced in an inactive 

collection status until the authorization was renewed. 


There were no reports issued on the collection, and the intercept 


was destroyed. 


(3)-P.L. 86-36 


on collection since! _ |an NS. 

learned that 

were outside of the scope authorized by 


ted by a n increase in activity from a target that has been 
Han NSA analyst researched the increase and 


)ourt. 


tHe (b)(1) 

-Jb)(3)-P.L. 86-36 


| Although there was 

no reporting resulting from the collection, the data was not remo ved from the 
databases and untill ~~1 As a result of this incident] 


3)-P.L. 86-36 


(3) (TS//SI/ /N F) D uring a baseline collection review of a FISA-auth orized target, 
we discoveredj |nstances of unauthorized targeting of that were 

believed to be associated with the target. 


) (i) 

)(3)-P.L. 86-36 


(b)(1) 

(b>(3> —P.L. 86-36 
(b)(3)-18 USC 798 
(b)(3)-50 USC 3024(i) 
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'tt»(1) 

(b) (3) -P. L. 86-36 


c ; i3) -S& OSC:, 3024 (i) 

(a) <TS//SI//NF) [ 


] while conducting a baseline review of a 


target because of incr eased activity, an NSA analyst noticed that[ 


that the targe t^ 


there were 
collection did no 


|were unfamiliar. Exten sive research led analysts to concl ude 

Colle ction was terminated onl I 
uring the period of targeting from l 

instances of collection, all of which have been destroyed. The 
result in reporting. 


(b) (T S // S I//NF) As a result of reviewing a target [~ 


|an NSA an alyst learned that a person [_ 

Further research associated the user with 


ol the Foreign Intelligence Surveillance Court (FISC) approved tar get. The 


outside 


and all intercept 

was deleted. There were no reports issued as of result of the collection. 


(b)(1) 

(b)(3)-P.L. 86-36 ( C ) (TS//SI//NF) [ 


was thought to be associated w ith a 


discover ed that 
]may have 


C 

ire|_ 


[that 


research ed further. 
targeted I 


Targetin g was discontinued while an NSA analyst 
an NSA analyst confirmed that the 


was actually 
election was ( 


. _ _ _ 

The unauthorized collection was deleted, and no reports were issued as a 

result from the invalid collection. 


(d) (TG//0I//NF)-A second instance of a 

|was 

also discovered on 




it was determined on | 

(that the user wasj 


] On that date, targeting ceased and 


>-36 

798 

3024(i) 


unauthorized collection. 

(4) (T S // S I//NF) T here were 


persons during this quarter j 


/fib) (1) 

(b)(3)-P.L. 86-36 

instances of unintentional collection of U. S. 





There were 


_thej_telephone numbers were authorized 

for tasking under a valid FISA Court Ord er. Although appr oved for collection, the 


telephone numbers were not tasked until 


when the new order, 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 USC 798 
(b)(3)-50 USC 3024(i) 
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(3)-P.L. 86-36 


which was to have the 


De 

_| ta: 


the number s were unintentiona lly omit 


, lephone numbers included, was signed. |_ 

tasked the| [telephone numbers without knowing that 


wasn’t until 


that the 



m the new court order application. It 
earned that new court order did not 


contain th q [ numbers. The resulting intercept was immediately destroyed, and 


no reports were issued based on that unauthorized intercept. A review of the 
procedures for implementing a signed court order was conducted to isolate any 
process weakness and to reduce the risk of future incidents. 


b. (U// FQUO) Unauthorized use of a SIGINT Database 

(S -HNSA is working with the| [to ident ify the facts surrounding a reported’ j 
misuse of a SIGINT Database by an _ employee. Allegedly, the employee 


86-36 


The results of the inquiry will be reported upon completion. 


c. (U//FOW0) Misuse of the U.S. SIGINT System 

■(TG//3I//NF7 As a result of receiving advanced training on USSID SP0018 and 

associated SIGINT directives, an NSA intern reported that a co-worker had _ 

misused the SIGINT System to target his foreign girlfriend | 

The OIG is investigating the alleged violation and will report the outcome of the 
inquiry. | {b)(1) 

'(b)(3)••-P.L. 86-36 

d. (U) Assistance to Law Enforcement 

<G// OI tDuri ng this quarter, the SID responded t o| |for linguistic support 

and | ~|for administrative assistance from the _ _ 

[respectively! 


e. (U) Working Aids 


(1) (U/ /FOU O) The SID Office of Oversight and Compliance maintains "U.S. 
Identities in SIGINT" and a matrix of dissemination authorities on its web page for 
use by the NSA/CSS Enterprise. The E.O., NSA/CSS Policy Number 1-23, DoD 
Regulation 5240.1-R, and USSID SP0018 are also available on-line. 


(2) (U// FOU O) The NSA/CSS NTOC created and implemented Standard 
Operating Procedures ( SOP) governing S IGINT and Information Assurance 


activities for the NTOC 


The SOP contains handling and reporting 


procedures governing the NTOC activities that affect U. S. Persons. 


(b)(31-P.L. 86-36 
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NSA STAFF PROCESSING FORM 


TO 

DIRECTOR 


EXREG CONTROL NUMBER 


THRU 

D/DIR 


SUBJECT 




(U//FOUO) Quarterly Report to the Intelligence Over¬ 
sight Board on NSA Activities—First Quarter FY06 


KCC CONTROL NUMBER 

IG-10600-06 


| [ APPROVAL 

PH SIGNATURE 
□ INFORMATION 


EXREG SUSPENSE 


KCC SUSPENSE 


ELEMENT SUSPENSE 


SUMMARY 

PURPOSE: (U// FOUO) To forward to the Intelligence Oversight Board (IOB) of the 
President’s Foreign Intelligence Advisory Board, via the Assistant to the Secretary of Defense 
for Intelligence Oversight (ATSD(IO)), NSA’s quarterly report on its intelligence activities. 

BACKGROUND: (U// FOUO) Executive Order 12333 and Executive Order 12863 
require Intelligence Community agency heads and Intelligence Community General Counsels 
and Inspectors General, respectively, to report to the IOB on a quarterly basis concerning 
intelligence activities that they have reason to believe may be unlawful or contrary to Executive 
Order or Presidential Directive. The enclosed memorandum covers all reportable activities 
known to the Inspector General and General Counsel. Per PIOB letter of 6 August 1982, 
Agency heads are responsible for reporting separately any additional reportable activities 
known to them, unless the President has specifically instructed that the Board is not to be 
informed. The Director’s signature signifies that no other activities that require reporting are 
known to him. 

RECOMMENDATION: (U) Director sign the enclosed memorandum. 


This document may be declassified 
and marked “UNCLASSIFIEDVFor 
upon removal of enclosure(s) 


••'•'(b) (3)-P.L. 86-36 


COORDINATION/APPROVAL 
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